When Does Oklahoma's New Consumer Privacy Law Take Effect for Marketers?

Oklahoma's Consumer Data Privacy Act (SB 546) takes effect January 1, 2027, and gives Oklahoma residents the right to opt out of having their personal data used for targeted advertising, sold to third parties, or processed for certain profiling. Businesses that meet the law's thresholds need a working opt-out mechanism and updated privacy disclosures in place before that date.

Who the Law Applies To

The OCDPA covers businesses that conduct business in Oklahoma or target Oklahoma residents, and that either process personal data of at least 100,000 Oklahoma consumers in a calendar year, or process data of at least 25,000 consumers while deriving more than half of gross revenue from selling personal data. The law's definition of "sale" is narrow — only exchanges of personal data for monetary consideration count, which excludes the broader "valuable consideration" standard some other states use.

What Marketers Specifically Have to Change

Oklahoma consumers get the right to opt out of processing for targeted advertising, the sale of personal data, and profiling that produces legal or similarly significant effects. Ad platforms and CDPs that already support Colorado- or Virginia-style opt-out signals can generally extend that same opt-out logic to Oklahoma residents rather than building a separate flow from scratch.

Enforcement Is AG-Only, With a Permanent Cure Period

Only the Oklahoma Attorney General can bring an enforcement action under the OCDPA — there's no private right of action, so Oklahoma consumers can't sue directly the way they might under the TCPA. Before suing, the AG must give a business 30 days to cure the violation. If the business doesn't cure it, the AG can seek statutory damages of up to $7,500 per violation. Unlike some states where the cure period sunsets after a few years, Oklahoma's right-to-cure is written into the statute permanently.

Who's Exempt

Financial institutions and data already regulated under the Gramm-Leach-Bliley Act, HIPAA-covered entities and their business associates, and nonprofit organizations are all exempt from OCDPA obligations.

Oklahoma Isn't Acting Alone

Oklahoma joins a wave of states whose comprehensive privacy laws took effect or were enacted around the same window. Indiana, Kentucky, and Rhode Island all brought their own comprehensive privacy laws into force on January 1, 2026, each with an AG-only enforcement model, a right-to-cure period, and a $7,500-per-violation statutory ceiling nearly identical to Oklahoma's. For a business already building compliance workflows around those three states' targeted-advertising opt-outs, extending that same logic to Oklahoma residents ahead of 2027 is largely a matter of adding one more jurisdiction to an existing list rather than designing a new process.

Bottom Line

If your business processes Oklahoma resident data at the law's thresholds, get a working opt-out mechanism for targeted advertising and data sales live before January 1, 2027 — the 30-day cure period gives room to fix gaps, but only after the Attorney General has already found one.

Sources: Oklahoma SB 546, the Oklahoma Consumer Data Privacy Act (signed into law March 20, 2026); JD Supra, "Oklahoma Enacts Consumer Data Privacy Law" and "Signed, Sealed and (Soon to Be) Delivered into Law: Oklahoma's New Data Privacy Law Becomes Effective January 1, 2027."